Unauthenticated OS command execution via unsandboxed GraalVM script evaluators in Orkes/Netflix Conductor workflow API (CVE-2026-58138)
Fortinet, reported by The Hacker News and SecurityWeek on 2026-09-18/19, confirms this pre-auth RCE is being exploited against exposed Conductor servers, and public exploits are catalogued in VulnCheck XDB, so any unpatched instance reachable by attackers should be treated as a compromise target now.
Conductor 3.21.21 through 3.30.1 evaluates JavaScript and Python expressions in INLINE, LAMBDA, DO_WHILE and SWITCH tasks with GraalVM host access set to ALL, and the workflow API accepts inline workflow definitions before authentication. A remote attacker can submit a workflow whose expression reaches Java reflection or ProcessBuilder and runs arbitrary OS commands on the Conductor server.
Affected: conductor-oss / Orkes Conductor >= 3.21.21 and < 3.30.2
How to Test
Check the deployed Conductor server version; anything from 3.21.21 up to but not including 3.30.2 is vulnerable. Review workflow API access logs and stored workflow definitions for unexpected inline workflow submissions containing INLINE, LAMBDA, DO_WHILE or SWITCH tasks whose JavaScript or Python expressions reference Java classes, reflection, Runtime, ProcessBuilder or subprocess calls, and check the Conductor host for unexpected child processes spawned by the server JVM.
How to Patch
Upgrade to Conductor 3.30.2 (release of 3 June 2026 containing PR #1123 'Restrict graaljs further' / commits 87a7d96a and c691e35e, which deny script access to Class, ClassLoader, reflection, Runtime, ProcessBuilder, Process, System and Thread). If the upgrade must wait, remove direct network exposure of the workflow API and place it behind authentication so untrusted clients cannot submit workflow definitions.